Typically attackers do this during an offline brute-force attack (where they have a copy of the hashed password, probably along with other user information from

Typically attackers do this during an offline brute-force attack (where they have a copy of the hashed password, probably along with other user information from the database). The attack is done by getting a list of plain text passwords and then running them through the same hashing algorithm as was used originally (adding the salt value if present). Once the attacker has done that they just compare the hashed strings. If they match then it'll be the same password. Commonly the attacker would start with a dictionary of common passwords and submit them along with common variants (eg, password, Password password1 passw0rd). If that's not successful they can move onto pure brute force (eg, a , ab, ac, etc)